RU2808759C1 - Method for controlling data integrity based on uneven coding - Google Patents

Abstract

FIELD: computer engineering.

EFFECT: providing data integrity control with different levels of data security depending on the degree of their value.

SUBSTANCE: technical result is achieved by converting data that must be protected from changes under the destructive influences of an attacker and disturbances in the operating environment into M_l blocks with more valuable data and the remaining M_j blocks, each of which is represented as a number from an extension of the Galois field GF(q ^m ) and combined into one array, which is subject to linear encoding (n'' ,k'')-code V'' with minimum distance d'', which provides different levels of their protection depending on the degree of their value.

1 cl, 3 dwg

Description

Field of technology to which the invention relates

The proposed invention relates to information technology and can be used to monitor the integrity of data in storage systems under conditions of destructive influences of an attacker and disturbances in the operating environment.

State of the art

Data sent for storage, subject to protection from changes, has varying degrees of value. Their value, depending on the type of information systems in question, for whose benefit the data is stored, can be determined by the following:

- the number of requests from system users;

- relevance (date of creation);

- category of the subject sending the data for storage, etc. (From data storage to information management. 2nd ed. - St. Petersburg: Peter, 2016. - 544 p.).

The level of security (confidentiality, integrity, availability) of data is determined by the security methods used. To monitor the integrity of data to be protected under conditions of destructive influences from an attacker and disturbances in the operating environment, it is necessary to calculate and subsequently store control data in an amount corresponding to the required level of protection (the higher the level of protection, the more control data needs to be calculated). Ensuring a high level of data security, regardless of the degree of its value, leads to premature consumption of storage system resources.

Rational use of the resources of data storage systems in modern conditions of continuous growth in the volume of data accumulated in them can be ensured by taking into account, when developing methods for monitoring data integrity, the fact that the data array to be protected contains data blocks with varying degrees of value.

a) Description of analogues

There are known methods for monitoring data integrity through the use of cryptographic methods: key hashing, electronic signature tools (Patent for invention RUS No. 2680033, 02/14/2019; Patent for invention RUS No. 2680350, 02/19/2019; Patent for invention RUS No. 2680739, 02/26/2019 ; Patent for invention RUS No. 2696425, 08/02/2019; Patent for invention RUS No. 2707940, 02.12.2019; Patent for invention RUS No. 2726930, 07.16.2020; Patent for invention RUS No. 2730365, 08.21.2020; Patent for invention RUS No. 2758194, 10.26.2021; Patent for invention RUS No. 2758943, 03.11.2021; Patent for invention RUS No. 2759240, 11.11.2021; Patent for invention RUS No. 2771146, 04.27.2022; Patent for invention RUS No. 2771208, 04/28/2022; Patent for invention RUS No. 2771209, 04/28/2022; Patent for invention RUS No. 2771236, 04/28/2022; Patent for invention RUS No. 2771238, 04/28/2022; Patent for invention RUS No. 2771273, 04/29/2022; Patent for invention RUS No. 27 74099 , 06/15/2022; Patent for invention RUS No. 2785484, 12/08/2022; Patent for invention RUS No. 2785800, 12/13/2022; Patent for invention RUS No. 2786617, 12/22/2022; Patent for invention RUS No. 2793782, 04/06/2023; Shannon, K. Works on information theory and cybernetics / K. Shannon. - M.: Foreign Literature Publishing House, 1963. - 829 p.; Schneier, B. Secrets and lies. Data security in the digital world / B. Schneier. - St. Petersburg: Peter, 2003. - 367 p.), for which two generalized schemes for calculating hash function values are typical: for each subblock in a data block and for the whole data block.

The disadvantages of these methods are:

- high redundancy when monitoring the integrity of the sequence of subblocks of a small data block (when calculating a separate hash function value for each subblock of a data block);

- inability to detect and localize corrupted subblocks of a data block (when hashing an entire data block and obtaining one common hash function value);

- inability to provide different levels of data security depending on the degree of their value.

There are known ways to control data integrity through the use of non-cryptographic methods: error-correcting codes (Morelos-Zaragoza, R. The art of error-correcting coding. Methods, algorithms, application / R. Morelos-Zaragoza; translation from English by V.B. Afanasyev. - M .: Technosphere, 2006. - 320 pp.; Hemming, R.V. Coding theory and information theory / R.V. Hemming; translation from English - M.: "Radio and Communication", 1983. - 176 pp.) .

The disadvantages of these methods are:

- data integrity monitoring is performed with a probability specific to the error-correcting code used, to increase which, as a rule, the introduction of high redundancy is required;

- inability to provide different levels of data security depending on the degree of their value.

b) Description of the closest analogue (prototype)

The closest in technical essence to the claimed invention (prototype) is a method for monitoring the integrity of multidimensional data arrays based on the rules for constructing the Reed-Solomon code (Invention Patent RUS No. 2785862, 12/14/2022), which provides the ability to detect and localize two or more blocks data with signs of integrity violation without calculating and introducing high redundancy of control data for this (Fig. 1).

The disadvantage of this known method is the inability to provide different levels of data security depending on the degree of their value.

Disclosure of the invention (its essence)

a) The technical result to be achieved by the invention

The purpose of the present invention is to develop a method for monitoring data integrity, providing different levels of data security depending on the degree of their value.

b) Set of essential features

This goal is achieved by the fact that in the known method of data integrity monitoring, which consists in the fact that in order to ensure the possibility of detecting and localizing data with signs of integrity violations, the initial array is divided into data blocks of a fixed length, with which transformations are subsequently performed; in the presented method, the array data M is fragmented into blocks with more valuable data and the remaining blocks each of which, in order to monitor data integrity, providing the ability to detect and localize data blocks with signs of integrity violations, is represented as a number from an extension of the Galois field and combine them into one array Where which is to be encoded by a linear (n'',k'') code V'' with a minimum distance d'', where - information blocks, - code word, and G'' denotes the generating matrix of the code, which is the maximum connection of the generating matrices G ₁ and G ₂ of the linear (n ₁ ,k ₁ )- and (n ₂ ,k ₂ )-codes V ₁ and V ₂ with minimum distances d ₁ and d ₂ , respectively, which provides for blocks M _l with more valuable data a greater degree of protection equal to , and for the remaining blocks M _j - a smaller but sufficient degree of protection equal to , depending on the required corrective ability, which allows, when monitoring data integrity, to ensure different levels of data security depending on the degree of their value, detection and localization of data blocks with signs of integrity violations is performed by dividing the code word b into two words And length n ₁ and n ₂ respectively, and calculating the remainder of the division of the resulting codeword to the generating polynomial g ₁ (x) of the code V ₁ , based on the results of which a decision is made about the absence of signs of integrity violation in the case of obtaining a remainder equal to 0, or the opposite.

A comparative analysis of the claimed solution with the prototype shows that the proposed method differs from the known one in that the set goal is achieved by converting data to be protected from changes under the destructive influences of an attacker and disturbances in the operating environment into blocks M _l with more valuable data and other blocks M _j , each of which is represented as a number from an extension of the Galois field and are combined into one array, which is subject to encoding with a linear (n'',k'') code V'' with a minimum distance d'', which provides different levels of their security depending on the degree of their value.

Monitoring the integrity of data blocks with different degrees of value is performed by using a linear code obtained by combining codes V ₁ and V ₂ with minimum distances d ₁ and d ₂ , respectively, which will allow control at time t under conditions of destructive influences of an attacker and disturbances in the operating environment data integrity, characterized by different levels of security depending on the degree of their value. What is new is that in the proposed method, the data array M is fragmented into blocks M _l with more valuable data and the remaining blocks M _j , each of which is represented as a number from an extension of the Galois field and combine them into one array so that blocks with more valuable data come first. What's new is that the array to be encoded by a linear (n'',k'') code V'' with a minimum distance d'', obtained by combining codes V ₁ and V ₂ with minimum distances d ₁ and d ₂ , respectively. What is new is that a greater degree of protection is provided for M _l blocks with more valuable data, equal to and for the remaining blocks M _j - a smaller but sufficient degree of protection, equal to depending on the required corrective ability, which allows, when monitoring data integrity, to ensure different levels of data security depending on the degree of their value. What is new is that the detection and localization of data blocks with signs of integrity violations is performed by dividing the code word b into two words And length n ₁ and n ₂ respectively, and calculating the remainder of the division of the resulting codeword to the generating polynomial code V ₁ , based on the results of which a decision is made about the absence of signs of integrity violation in the case of receiving a remainder equal to 0, or the opposite.

c) Cause-and-effect relationship between characteristics and technical result

Thanks to a new set of essential features, the method implements the following capabilities:

- data integrity control based on number-theoretic transformations in extensions of Galois fields;

- data integrity control, providing different levels of data security depending on the degree of their value.

Evidence of compliance of the claimed invention with the conditions of patentability “novelty” and “inventive step”

The analysis of the level of technology made it possible to establish that there are no analogues characterized by a set of features identical to all the features of the claimed technical solution, which indicates that the claimed method complies with the patentability condition of “novelty”.

The results of a search for known solutions in this and related fields of technology in order to identify features that coincide with the features of the claimed object that are distinctive from the prototype, showed that they do not follow explicitly from the prior art. The prior art also does not reveal the knowledge of distinctive essential features that determine the same technical result that was achieved in the claimed method. Therefore, the claimed invention meets the patentability requirement of “inventive step”.

Brief description of drawings

The claimed method is illustrated by drawings, which show:

- fig. 1 is a diagram illustrating a method for monitoring the integrity of multidimensional data arrays based on the rules for constructing the Reed-Solomon code;

- fig. 2 is a diagram illustrating the order of uneven encoding of a data array M;

- fig. 3 is a diagram illustrating the order of localization of data blocks with signs of integrity violation.

Carrying out the invention

Data to be protected from changes during storage is presented in the form of a data array M, which is fragmented into data blocks with more valuable data and with the rest of the array data.

Each data block M _l and M _j is represented as a number from an extension of the Galois field . Next, the data blocks are combined into one array: Where ), and the blocks with the most important data come first (Fig. 2).

Let V be a linear (n,k) code with minimum distance d, - information symbols, - a codeword. G denotes the generating matrix of the code V, and T the transition matrix, then b=aG and a=bT.

Let's consider a particular type of connection of the first type of matrices A and B:

where C'' is the maximum connection of matrices A and B.

To encode the array p, it is necessary to obtain the code V'' with the generating matrix G''. To do this, you need to combine the generating matrices G ₁ and G ₂ of the codes V ₁ and V ₂ , which are linear (n ₁ ,k ₁ ) and (n ₂ ,k ₂ ) codes over GF(q ^m ) with minimal distances d ₁ and d ₂ respectively. The result is a linear (n ₁ +n ₂ ,k ₁ ) code V'' over GF(q ^m ) with a minimum distance d'', k ₂ information symbols of which have a degree of protection . The first k ₁ symbols of the code word V'' are information symbols, and the last symbols - verification. Among k ₁ information symbols, k ₂ have a degree of protection t'', and the remaining information symbols, as well as check symbols, have a degree of protection

The generating matrix G'' is constructed by connecting the generating matrices G ₁ and G ₂ . It will look like:

Generating matrices G ₁ and G ₂ are constructed by division And to the generating polynomials g ₁ (x) and g ₂ (x). The generating polynomials g ₁ (x) and g ₂ (x) are found in accordance with the following expression:

The coefficients of the polynomials obtained in the remainder at each division step are the rows of the generating matrix. The rows of coefficients are written into the matrix in the reverse order of division.

The codeword sent for storage is calculated by multiplying the row of information blocks a by the matrix G'':

The described design makes it possible to construct linear codes with a distance greater than that of the original codes in the case when the number of information symbols is fixed and it is necessary to increase the minimum code distance by increasing the length, that is, the number of check symbols.

When the user accesses the stored word b', it is split into two words: And . The word is divided to the generating polynomial g ₁ (x) of the code V ₁ .

If the remainder of the division is 0, it is considered that the integrity of the data blocks is not violated. Otherwise, it is considered that the integrity of the data blocks in storage has been violated. In this case, they are localized.

For this purpose, error locators are defined. To do this, calculate the remainder e(x) from division on g ₁ (x), called the error polynomial. Next, the error syndrome is determined, the degree of which coincides with the degree of the error polynomial. The error syndrome polynomial coefficients are determined by the formula , where a is the primitive element of the Galois field extension used, i is the degree of the elements of the error polynomial, where z is the degree of the error polynomial.

The locator polynomial L(x) is defined as , where P ^-1 is the matrix inverse of the matrix P.

Matrix P is defined as

and column V is found as

in this case S _t is the corresponding coefficient of the error syndrome polynomial.

As a result of calculation using the formula the resulting column is:

After this, L is represented in polynomial form.

To find error locators, you need to find the roots of the locator polynomial and their inverses. These numbers should be represented as the degree of the primitive term of the Galois field extension used; the exponent coincides with the degree of the element of the codeword polynomial in which the error was made.

As a result of the localization process (Fig. 3), the positions of data blocks with signs of integrity violation are determined. In particular, in k ₂ information blocks, if no more than t'' errors occurred, as well as signs of integrity violations in the remaining blocks, provided that no more than t ₁ errors occurred.

Example. The following data array must be sent for storage:

Let the first 12 characters be the most important (they require a high degree of security).

Before sending the data array M, in which some data has the greatest value, for storage, we will perform encoding using the rules for constructing codes with unequal symbol protection. To do this, we fragment the data array M into data blocks M _l and M _j of fixed length m=4.

We will receive 3 data blocks which need to be provided with a high degree of protection and 6 data blocks for which a high degree of protection is not required:

- for M _l : M ₁ = [0111], M ₂ = [0101], M ₃ = [1010];

- for M _j : M ₁ = [0000], M ₂ = [1001], M ₃ = [0001], M ₄ = [0001], M ₅ = [0001], M ₆ = [1001].

Next, we represent data blocks in the form of sets of characters of some alphabet, for which the Galois field of the extension is used binary Galois field . Then we combine the data blocks into a data array p[9].

The data after being represented as a number from the Galois field of the extension will look like this:

After presentation, we will perform operations with each data block as with a number from a Galois field, that is, all arithmetic operations will be performed according to the rules of arithmetic in Galois fields.

To construct a code with unequal symbol protection, we choose the following codes: (15,9)-code V ₁ and (7,3)-code V ₂ (Reed-Solomon codes).

Code V ₁ has a degree of protection , code V ₂ has a degree of protection

Let's construct generating polynomials for codes V ₁ and V ₂ (all operations are performed according to the rules of arithmetic in Galois fields):

Generating matrices for codes V ₁ and V ₂ are constructed in the manner described above.

To construct a code with unequal symbol protection, we construct a maximal connection of matrices G ₁ and G ₂ :

To be able to monitor the integrity of the data, we will encode the data p; to do this, we will multiply the original data by the generating matrix of the code with unequal symbol protection C=pG''.

As a result, the following data is sent for storage:

Let’s assume that errors occurred in the data during storage (data integrity violation). When requesting their use, the following data was received:

We split the accepted word b' into two words And we get:

Decoding the word . Let's write down the word in polynomial form:

To detect and correct the error, we will divide on and we get the error polynomial:

The error syndrome polynomial will take the form:

Let's create a matrix P and a vector V:

Let's find the inverse matrix:

Let's find a polynomial of error locators:

Let's find the roots of the polynomial L(x) and get:

Error locators in this case look like:

In accordance with the received locators, blocks with signs of integrity violations have the following positions: x ¹⁴ , x ¹³ , x ¹² .

Thus, a method is presented for monitoring data integrity, providing different levels of data security depending on the degree of their value. In particular, an example is given of uneven coding and localization of data blocks that have signs of integrity violations when using a code with unequal symbol protection (Reed-Solomon codes: (15,9)-code V ₁ and (7,3)-code V ₂ ) .

Claims (1)

A method for monitoring data integrity based on uneven coding, which consists in the fact that in order to ensure the possibility of detecting and localizing data with signs of integrity violations, the initial array is divided into data blocks of a fixed length, with which transformations are subsequently performed, characterized in that the data array M is fragmented into blocks with more valuable data and the remaining blocks each of which, in order to monitor data integrity, providing the ability to detect and localize data blocks with signs of integrity violations, is represented as a number from an extension of the Galois field and combine them into one array , Where which is to be encoded by a linear (n'',k'') code V'' with a minimum distance d'', where - information blocks, - code word, and G'' denotes the generating matrix of the code, which is the maximum connection of the generating matrices G ₁ and G ₂ of the linear (n ₁ ,k ₁ )- and (n ₂ ,k ₂ )-codes V ₁ and V ₂ with minimum distances d ₁ and d ₂ , respectively, which provides for blocks M _l with more valuable data a greater degree of protection equal to and for the remaining blocks M _j - a smaller but sufficient degree of protection equal to , depending on the required corrective ability, which allows, when monitoring data integrity, to ensure different levels of data security depending on the degree of their value, detection and localization of data blocks with signs of integrity violations is performed by dividing the code word b into two words And length n ₁ and n ₂ respectively, and calculating the remainder of the division of the resulting codeword to the generating polynomial g ₁ (x) of the code V ₁ , based on the results of which a decision is made about the absence of signs of integrity violation in the case of obtaining a remainder equal to 0, or the opposite.